XSS in Proofpoint Threat Response Auto Pull
CVE-2023-2819
A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allow an authenticated administrator on an adjacent network to replace the image file with an arbitrary MIME type. This could result in arbitrary javascript code execution in an admin context. All versions prior to 5.10.0 are affected.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (17.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
Affected products
Weakness classification (CWE)
References
- security@proofpoint.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-2819?
- CVE-2023-2819 is a medium-severity vulnerability in Proofpoint Threat Response Auto Pull, classified under Cross-site Scripting. CVSS score: 4.3/10. Published 2023-06-14.
- How severe is CVE-2023-2819?
- Medium severity. CVSS v3 base score is 4.3 out of 10.